This is actually easy to solve using normal "network" behaviour, that is making the IPSec gateway respond with SNMP unreachable message if it can't send the package to it's destination.<br><br>Here is an example using IPtables. In this example the IPsec clients have addresses in the <a href="http://10.0.1.0/24">10.0.1.0/24</a> network and they are terminated on the WAN-interface:<br>
<br>iptables -A WAN_OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT<br>iptables -A WAN_OUTPUT -d <a href="http://10.0.1.0/24">10.0.1.0/24</a> -j REJECT --reject-with icmp-admin-prohibited<br><br>Explanation:<br>
If the package is going out an established connection ACCEPT it. If there is no established connection reject all packages to the IPsec network with SNMP-message.<br><br><br clear="all"><font><span style="font-family:arial,helvetica,sans-serif">Regards,<br>
<br></span></font><b>Hans-Kristian Bakke</b><br><font size="1"><span style="color:rgb(51,51,51)"></span></font><br>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Apr 13, 2012 at 21:57, Shukla, Sanjay <span dir="ltr"><<a href="mailto:Sanjay.Shukla@ipc.com" target="_blank">Sanjay.Shukla@ipc.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">I request you urgent help in understanding this behavior.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">When a connection is configured in /etc/ipsec.conf but the left side of the connection is not responding (say left is unreachable) I see the ping behavior as below<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-right:.9pt;margin-bottom:0in;margin-left:13.6pt;margin-bottom:.0001pt;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:teal">root@ffd-ipsec-189 sanjay]# ping 10.204.74.188<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">basically ping is stuck or blocked.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Now if I do not have a connection configured in the /etc/ipsec.conf I see that the ping responds like this<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-right:.9pt;margin-bottom:0in;margin-left:13.6pt;margin-bottom:.0001pt;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:teal">root@ffd-ipsec-189 sanjay]# ping 10.204.74.188<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-right:.9pt;margin-bottom:0in;margin-left:13.6pt;margin-bottom:.0001pt;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:teal">PING 10.204.74.188 (10.204.74.188) 56(84) bytes of data.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-right:.9pt;margin-bottom:0in;margin-left:13.6pt;margin-bottom:.0001pt;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:teal">From 10.204.74.189 icmp_seq=2 Destination Host Unreachable<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-right:.9pt;margin-bottom:0in;margin-left:13.6pt;margin-bottom:.0001pt;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:teal">From 10.204.74.189 icmp_seq=3 Destination Host Unreachable<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-right:.9pt;margin-bottom:0in;margin-left:13.6pt;margin-bottom:.0001pt;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:teal">From 10.204.74.189 icmp_seq=5 Destination Host Unreachable<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">What settings can be done for a timeout to occurs to that a program that is trying to reach an ip may not be blocked forever if ipsec SA cannot be established ?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My connection setting as follows<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">#Below Are The Configuration for CCM_CCM IPSec Tunnel<u></u><u></u></p>
<p class="MsoNormal">conn LocalIP_LocalIP_10.204.74.188<u></u><u></u></p>
<p class="MsoNormal"> left=10.204.74.189<u></u><u></u></p>
<p class="MsoNormal"> leftcert=ServLcl.pem<u></u><u></u></p>
<p class="MsoNormal"> leftsendcert=yes<u></u><u></u></p>
<p class="MsoNormal"> leftupdown=/opt/ipc/security/ipsectunnel/rightdown.sh<u></u><u></u></p>
<p class="MsoNormal"> right=10.204.74.188<u></u><u></u></p>
<p class="MsoNormal"> rightid=%any<u></u><u></u></p>
<p class="MsoNormal"> keyexchange=ikev2<u></u><u></u></p>
<p class="MsoNormal"> type=transport<u></u><u></u></p>
<p class="MsoNormal"> reauth=no<u></u><u></u></p>
<p class="MsoNormal"> dpddelay=5s<u></u><u></u></p>
<p class="MsoNormal"> dpdaction=restart<u></u><u></u></p>
<p class="MsoNormal"> keyingtries=%forever<u></u><u></u></p>
<p class="MsoNormal"> auto=route<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">regards,<u></u><u></u></p>
<p class="MsoNormal">-sanjay<u></u><u></u></p>
</div>
<p><span style="FONT-FAMILY:'Palatino Linotype','serif';COLOR:green;FONT-SIZE:10pt"><i><span style="FONT-FAMILY:'Palatino Linotype','serif'"><font size="1"></font></span></i></span> </p>
<p><span style="FONT-FAMILY:'Palatino Linotype','serif';COLOR:green;FONT-SIZE:10pt"><i><span style="FONT-FAMILY:'Palatino Linotype','serif'"><font size="1"><img alt=""><span style="FONT-FAMILY:'Palatino Linotype','serif';COLOR:green;FONT-SIZE:10pt"><i><span style="FONT-FAMILY:'Palatino Linotype','serif'"><font size="1">Please
consider the environment before printing this email.</font></span></i></span></font></span></i></span></p>
<br>
<br>
<hr>
<font color="Gray" face="Arial">DISCLAIMER: This e-mail may contain information that is confidential, privileged or otherwise protected from disclosure. If you are not an intended recipient of this e-mail, do not duplicate or redistribute it by any
means. Please delete it and any attachments and notify the sender that you have received it in error. Unintended recipients are prohibited from taking action on the basis of information in this e-mail.E-mail messages may contain computer viruses or other defects,
may not be accurately replicated on other systems, or may be intercepted, deleted or interfered with without the knowledge of the sender or the intended recipient. If you are not comfortable with the risks associated with e-mail messages, you may decide not
to use e-mail to communicate with IPC. IPC reserves the right, to the extent and under circumstances permitted by applicable law, to retain, monitor and intercept e-mail messages to and from its systems.<br>
</font>
</div>
<br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div><br></div>